Method for monitoring and implementing security policies in device

Abstract

A method for monitoring and enforcing security policies in a device, the device comprising a data store installed with an operating system, the operating system having a user space and a kernel space, the method comprising the steps of: providing at least one packet filter module; providing a data bus; providing a security policy; providing at least one strategy implementation module; collecting kernel data from a kernel space, and processing and converting the collected kernel data into corresponding one or more events through a packet filtering module; sending the event to a data bus, storing the event in the data bus, and sending the event to a policy enforcement module; monitoring the device by evaluating the event using an evaluation algorithm and identifying a threat event; if the threat event is identified, identifying, by a policy enforcement module, one or more security policies; and implementing the identified security policy through a policy implementation module.

Description

Technical Field

[0001] The present specification relates to methods for monitoring and enforcing security policies in a device.

[0002] The method of the present specification can be implemented to counter known or unknown network security attacks against devices installed with operating systems. In particular, the present invention relates to embedded security solutions for protecting devices, and in particular for IoT embedded devices. Background Art

[0003] Embedded IoT devices are widely used to control other devices or the surrounding environment due to their ability to collect data and communicate with users.Embedded devices are becoming an important and necessary part of daily life, and the speed and reliability of embedded devices are improving day by day.

[0004] Embedded systems and devices have numerous advantages as they can be used in all types of industries such as automotive, healthcare, aerospace and defense, etc. Additionally, embedded systems are cost-effective, energy-efficient, and provide many opportunities for improvement and upgrading.

[0005] However, embedded systems and devices are potentially exposed to cyber attacks and malicious activities that could compromise the security of the system.

[0006] Existing solutions provide limited methods to ensure device security. In particular, known methods and software operate at the network or cloud level through external programs.

[0007] Problems with the Background Art

[0008] Since the known methods are implemented in software external to the device, these methods are only relevant for network intrusions and network attacks. Furthermore, the known methods and software require active and continuous communication with external entities and with the device. In practice, the security mechanisms operate remotely and the countermeasures identified for the network attack need to be communicated to the device or cloud service. As a result, current prior art methods and software may introduce delays in the protection process and may not be able to block potential threats quickly enough. Summary of the invention

[0009] The object of the invention in question is to provide a method for monitoring and implementing security policies in a device that overcomes the disadvantages of the prior art.

[0010] Another object of the invention is to obtain a method for monitoring and implementing security policies in an installation, which makes it possible to reduce the risks of network attacks and reduce the efforts of manual human intervention.

[0011] Advantages of the present invention

[0012] The method for monitoring and implementing security policies in the device is an embedded method that allows observability of the device by directly collecting kernel data (such as processes, system calls, file systems, and networking data, etc.) to evaluate internal processes in the device. In this way, a deeper level of protection can be achieved by embedding security in the device.

[0013] The method of the present invention may also ensure faster countermeasures to threat events because these countermeasures are generated directly from the collected kernel data and, unlike prior art methods, do not rely on external sources such as cloud services.

[0014] In particular, by means of an embodiment, the method implements an enhanced Berkeley Packets Filter probe to communicate directly with the kernel of the operating system. The method is in fact particularly useful for Linux systems. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] The characteristics and advantages of the invention will become apparent from the following detailed description of a possible practical embodiment of the invention illustrated by way of non-limiting example in the accompanying drawings, in which:

[0016] - Figure 1 A flow chart showing a series of steps of an embodiment of the method of the present invention;

[0017] - Figure 2 Show that it can be executed Figure 1 Schematic diagram of the computer program of the method. DETAILED DESCRIPTION

[0018] The invention relates to a method for monitoring and implementing security policies in a device 1. In particular, the invention aims at a method that allows observability of the device 1, i.e. measuring the state of the device based on data generated by the device, and protecting the device from cyber attacks.

[0019] In more detail, the invention allows monitoring and identifying vulnerabilities of firmware through a method embedded in the device 1 for monitoring and enforcing security policies.

[0020] In the drawings, reference numeral 1 refers to an apparatus 1 which includes a data storage section (eg, a hard disk (not shown in the drawings)) in which an operating system OS resides and is installed.

[0021] Within the scope of the present invention, Figure 2The operating system OS schematically illustrated in is software that allows management of files, memory, processes and control of input and output and peripheral devices. As is well known to those skilled in the art, the operating system divides the virtual memory into a kernel space KS and a user space US.

[0022] Preferably, the operating system OS comprises one of the known operating systems such as Microsoft Windows, etc., or one of the Unix-like operating systems based on the Linux kernel.

[0023] The method comprises the following steps: a) providing at least one packet filtering module 2 residing in the user space US of the operating system OS.

[0024] The packet filtering module 2 is configured to read and collect kernel data directly from the kernel space KS of the operating system OS, and convert the collected kernel data into corresponding one or more events. More specifically, the packet filtering module 2 is configured to collect granular data with low overhead and group these granular data into formatted events, which are available in the user space US.

[0025] In the context of the present invention, an event is a message comprising general information or details related to the collected data. Each event comprises a header and / or a payload related to predetermined information (general or detailed) of the collected kernel data.

[0026] Advantageously, the packet filtering module 2 of the present invention allows evaluating internal processes in the device 1 by directly collecting kernel data, thereby ensuring security and execution efficiency.

[0027] According to a preferred embodiment, the packet filtering module 2 includes an enhanced Berkeley Packet Filter (eBPF). eBPF is a technology that allows sandbox programs to run in the operating system kernel and safely extend kernel capabilities without modifying the kernel source code or loading kernel modules that may cause kernel errors.

[0028] The method comprises the following steps: b) providing a data bus 3 residing in the user space US of the operating system OS and in signal communication with at least one packet filter module 2 to receive events from the packet filter module 2. The data bus 3 is thus configured to store received events.

[0029] It should be noted that the data bus 3 is a virtual communication system that allows data to be transmitted between components or virtual modules of the device. In other words, the data bus 3 is configured to receive and / or send data and store received data, which can be accessed by any module communicating with the data bus.

[0030] The method further comprises the following steps: c) providing a plurality of security policies residing in the user space US of the operating system OS, each of the plurality of security policies comprising a set of executable actions or commands. Preferably, the set of executable actions or commands comprises one or more of the following items: executing operating system functions; limiting connections to / from specific IP addresses; and killing undesirable processes. Also preferably, the set of executable actions or commands comprises a list of any actions or commands that the device can perform to prevent or counter a network security attack.

[0031] The method comprises the following steps: d) providing at least one policy enforcement module 4, which resides in the user space US of the operating system OS and performs signal communication with the data bus 3 to receive events from the data bus 3. The policy enforcement module 4 is configured to execute one or more security policies in the device.

[0032] Then, the method comprises the following steps: e) collecting kernel data from the kernel space KS through the packet filtering module 2.

[0033] The method further comprises the following steps: f) processing the collected kernel data through the packet filtering module 2 and converting it into one or more corresponding events.

[0034] The method comprises the following steps: g) sending one or more events to the data bus 3 via the packet filtering module 2; g') storing one or more events in the data bus 3; and g") sending one or more events to the policy enforcement module 4 via the data bus 3.

[0035] It should be noted that steps g), g') and g") should only be performed in this particular order in the first application of the method. In practice, since more events may be sent from the packet filter module 2 to the data bus 3 and stored in the data bus 3, there may be a temporal overlap of these steps, which may depend on the operation of the device.

[0036] The method comprises the following steps: h) monitoring the device 1 by evaluating events by the policy enforcement module 4 and identifying one or more threat events.

[0037] The policy enforcement module 4 includes an evaluation algorithm configured to receive events and a plurality of security policies as input, evaluate the received events, identify threat events, and identify corresponding one or more security policies based on the identified threat events. Therefore, the output of the algorithm is the identified security policies and the identified threat events.

[0038] Then, the method comprises the following steps: i) if a threat event is identified by the evaluation algorithm, one or more security policies are identified from a plurality of security policies by the policy enforcement module 4 .

[0039] Finally, the method comprises the following steps: j) implementing the identified security policies through the policy implementation module 4 to prevent or counter network attacks.

[0040] It should be noted that the method of the present invention allows real-time data monitoring with minimal latency and system overhead due to direct collection of kernel data. Specifically, the method allows for timely responses because timely responses do not require communication with external entities.

[0041] According to a preferred embodiment of the present invention, at least one packet filtering module 2 comprises at least one virtual probe 5 (preferably an eBPF probe), and the at least one virtual probe 5 is configured to read and collect kernel data.

[0042] It should be noted that the virtual probe 5 is configured to connect the kernel space KS to the user space US to extract data from the kernel space SP and make the data available in the user space US.

[0043] Preferably, the virtual probe 5 is associated with a corresponding activity of the operating system OS. The activity of the operating system OS is preferably related to one of the following items: networking, traffic pattern, file system, process, device activity and system call.

[0044] Optionally, step a) providing at least one packet filtering module 2 comprises the following sub-steps: a') providing a plurality of packet filtering modules 2, each packet filtering module 2 comprising a corresponding virtual probe 5 associated with a corresponding activity to be monitored. Alternatively, at least one packet filtering module 2 comprises a plurality of virtual probes 5, wherein each virtual probe 5 is associated with a corresponding activity to be monitored.

[0045] It should be noted that, in this way, each virtual probe 5 of the packet filtering module 2 or a corresponding virtual probe 5 of each packet filtering module 2 is configured to collect and transform kernel data independently of the other virtual probes 5 .

[0046] According to a preferred embodiment of the present invention, step e) processes and converts the collected kernel data into one or more events, including the following sub-steps: e') for each event, generates a header and / or a payload according to the corresponding collected kernel data. Specifically, the header of the event includes one or more of the following items: timestamp, event type, source module, string or image related to the event, threat flag. In addition, the event payload includes one or more of the following items: path of the file, path of the directory, permission set, IP address, deleted file name, source or destination port, TPC connection, length of the packet, DNS question, DNS answer, number or list of arguments passed to the executable file.

[0047] According to a first embodiment, the evaluation algorithm of the policy enforcement module 4 comprises an algorithm based on domain specific language rules, ie DSL rules.

[0048] Within the scope of the present invention, a DSL rule is a logical construct defined using a domain specific language that is shared between the method and the user writing the rule.

[0049] Preferably, each DSL rule comprises at least one logical construct defined by a corresponding condition to be verified. More preferably, each DSL rule comprises two logical constructs, namely, a condition to be verified and a corresponding at least one security policy.

[0050] Still according to the first embodiment, step h) the monitoring device 1 preferably comprises the following sub-steps: h-1) comparing the event with one or more conditions of the DSL rules.

[0051] Preferably, in step h) the monitoring device 1 further comprises the following sub-steps: h-2) generating a conditional output according to the comparison, wherein the conditional output comprises an affirmative conditional output and / or a negative conditional output.

[0052] Also preferably, in step h) the monitoring device 1 further comprises the following sub-steps: h-3) for a positive condition output, generating a threat flag for the corresponding event and marking the event as a threat event.

[0053] Also preferably, in step h) the monitoring device 1 further comprises the following sub-steps: h-4) identifying at least one corresponding security policy for the threat event.

[0054] Also according to the first embodiment of the present invention, step j) implementing the identified security policy comprises the following sub-steps: j-1) evaluating the conditional output, and implementing the identified security policy for a positive conditional output.

[0055] According to a second embodiment of the present invention, instead of the first embodiment, the evaluation algorithm includes a supervised or semi-supervised machine learning algorithm. In particular, the machine learning algorithm includes one of the following: a neural network algorithm, a random forest algorithm, an integrated algorithm.

[0056] It should be noted that the supervised algorithm allows for a binary classification of each event, whereas the semi-supervised algorithm is initially trained using only non-threatening events, which then allow for the comparison of each event with the distribution of observed events.

[0057] Preferably, step h) monitoring device 1 comprises the following sub-step: h-1') generating a score output for each event. In more detail, in case of a supervised machine learning algorithm, sub-step h-1') generating a score output for each event envisages the generation of a scalar binary output.

[0058] Also preferably, step h) the monitoring device 1 comprises the following sub-steps: h-2') for a score above a predetermined threshold, generating a threat flag for the corresponding event and marking the event as a threat event. In more detail, in the case of a supervised machine learning algorithm, the threat flag is generated based on a comparison of a scalar binary output with a predetermined value, while in the case of a semi-supervised algorithm, the threat flag is generated when the event is to be considered as being derived from a different distribution relative to the distribution of observed events.

[0059] Also preferably, step h) monitoring device 1 comprises the following sub-steps: h-3') identifying at least one corresponding security policy for the threat event.

[0060] Also according to the second embodiment of the present invention, step j) implementing the identified security policy comprises the following sub-steps: j-1′) evaluating the score output, and implementing the identified security policy for a score output above a predetermined threshold.

[0061] Advantageously, the method of the invention allows reducing the risk of cyber attacks and reducing the effort of manual human intervention. In fact, the method is embedded in the device, allowing a deeper level of protection.

[0062] Since the method of the invention is embedded in the device 1 and does not rely on external sources, it can also ensure faster countermeasures to threat events, since these countermeasures are generated directly from the collected kernel data.

[0063] Furthermore, the method according to the invention thus allows protection and security to be implemented in the device 1 in an autonomous manner.

[0064] Another object of the invention is a computer program (for example software) residing in a data storage of a device 1 , comprising instructions which, when this program is executed by the device 1 , cause the device to perform the steps of the method of the present description.

[0065] An exemplary application of the method of the invention is described below for an IoT Linux device which is equipped with industrial gateway functionality and is therefore dedicated to routing and packet routing activities.

[0066] In the described example, the apparatus 1 comprises a computer program according to the present description, which may be run in the background and then the apparatus is started.

[0067] Specifically, providing a plurality of packet filtering modules 2 according to sub-step a') of the method of the present specification envisages providing at least four eBPF modules, each of which includes a virtual eBPF probe 5 for a corresponding system activity. In this example, the system activities are related to networking, file system, process execution, and system calls, and each of these system activities is therefore monitored by a corresponding eBPF probe in a manner independent of other system activities.

[0068] For each virtual probe 5, the method envisages the following sub-steps: e') generating, for each event, a header and a payload for the corresponding system activity. It should be noted that in the example described, most events are likely to be generated by the networking packet filtering module 2, these events being related to the opening or closing of connections between gateways and other devices.

[0069] In the described example, according to the first embodiment of the invention, the DSL rules on which the algorithm of the policy enforcement module 4 is based include an IP blacklist, and the corresponding security policy includes a list of actions related to the termination of connections with specific devices. In this way, the method of the present description allows blocking or terminating connections with devices having corresponding IPs reported in the blacklist.

[0070] Alternatively, according to a second embodiment, the AI ​​model on which the algorithm of the policy enforcement module 4 is based tracks a series of packets and marks these packets as threat events, and the corresponding security policy includes a list of actions related to the immediate termination of the connection and the blocking of further access. In this way, the method of the present specification allows the marked packets to be identified as abnormal behavior or malware attacks (e.g., DDoS attacks) of the device 1 and the access to the device 1 is terminated or blocked.

Claims

1. A method for monitoring and implementing a security policy in a device (1), the device comprising a data storage unit in which an operating system (OS) resides and is installed, the method comprising the following steps: a) providing at least one packet filtering module (2), the at least one packet filtering module (2) residing in a user space (US) of the operating system (OS), the packet filtering module (2) being configured to directly read and collect kernel data from a kernel space (KS) of the operating system (OS), and convert the collected kernel data into one or more corresponding events; b) providing a data bus (3), the data bus (3) residing in the user space (US) of the operating system (OS) and in signal communication with the at least one packet filter module (2) to receive events from the packet filter module (2), the data bus (3) being configured to store the received events; c) providing a plurality of security policies, wherein the plurality of security policies reside in the user space (US) of the operating system (OS), each security policy comprising a set of executable actions or commands; d) providing at least one policy enforcement module (4), the at least one policy enforcement module (4) residing in the user space (US) of the operating system (OS) and in signal communication with the data bus (3) to receive events from the data bus (3), the policy enforcement module (4) being configured to execute one or more security policies in the device; e) collecting kernel data from the kernel space (KS) through the packet filtering module (2); f) processing and converting the collected kernel data into one or more corresponding events through the packet filtering module (2), each event including a header and / or a payload related to predetermined information of the collected kernel data; g) sending one or more events to the data bus (3) via the packet filtering module (2), g') storing the one or more events in the data bus (3), and g") sending the one or more events to the policy enforcement module (4) via the data bus (3); h) monitoring the device (1) by evaluating events and identifying one or more threat events by the policy enforcement module (4), the policy enforcement module (4) comprising an evaluation algorithm configured to receive events and the plurality of security policies as inputs, evaluate the received events, identify threat events, and identify corresponding one or more security policies based on the identified threat events; i) if a threat event is identified by the evaluation algorithm, identifying one or more security policies from the plurality of security policies by the policy enforcement module (4); j) Implementing the identified security policy by the policy implementation module (4).

2. The method according to claim 1, wherein: The packet filtering module (2) includes an enhanced Berkeley packet filter.

3. The method according to claim 1 or 2, wherein: The at least one packet filtering module (2) comprises at least one virtual probe (5), the virtual probe (5) being configured to read and collect kernel data, and The virtual probe (5) is associated with a corresponding activity of the operating system (OS), the activity preferably being related to one of the following: networking, traffic patterns, file systems, processes, device activities and system calls.

4. The method according to claim 3, wherein: Step a) of providing at least one packet filter module (2) comprises the following sub-steps: a') of providing a plurality of packet filter modules (2), each packet filter module (2) comprising a respective virtual probe (5) associated with a respective activity to be monitored.

5. The method according to any one of claims 1 to 4, wherein: Step e) processing and converting the collected kernel data into one or more events comprises the following sub-steps: e') for each event, generating a header and / or a payload according to the corresponding collected kernel data, and wherein, The header of the event includes one or more of the following items: a timestamp, an event type, a source module, a string or image related to the event, and a threat flag; The payload of the event includes one or more of the following: path to a file, path to a directory, permission set, IP address, source or destination port, TCP connection, length of packet, DNS question, DNS answer, number or list of arguments passed to an executable file.

6. The method according to any one of claims 1 to 5, wherein: The evaluation algorithm of the policy implementation module (4) comprises an algorithm based on domain specific language rules, namely DSL rules, each DSL rule comprising a corresponding condition to be verified.

7. The method according to claim 6, wherein: Step h) monitoring the device (1) comprises the following sub-steps: h-1) comparing the event with one or more conditions of the DSL rule, h-2) generating a conditional output according to the comparison, wherein the conditional output includes a positive conditional output and / or a negative conditional output, h-3) for the positive condition output, generate a threat flag for the corresponding event and mark the event as a threat event, h-4) Identifying at least one corresponding security policy for the threat event.

8. The method according to any one of claims 1 to 5, wherein: The evaluation algorithm includes a supervised or semi-supervised machine learning algorithm, and the machine learning algorithm includes one of a neural network algorithm, a random forest algorithm, and an integrated algorithm.

9. The method according to claim 8, wherein: Step h) monitoring the device (1) comprises the following sub-steps: h-1') generates a score output for each event, h-2′) for a score higher than a predetermined threshold, generating a threat flag for the corresponding event and marking the event as a threat event, h-3′) Identify at least one corresponding security policy for the threat event.

10. The method according to any one of claims 6 to 9, wherein: Step j) implementing the identified security policy includes the following sub-steps: j-1) evaluating the conditional output and implementing the identified security policy for a positive conditional output, or j-1′) evaluating the score outputs and implementing the identified security policies for the score outputs above the predetermined threshold.

Images